OpenLink Virtuoso-Opensource Denial-of-Service Vulnerability in QST Vector Set Component

A denial-of-service vulnerability has been identified in OpenLink Virtuoso-Opensource version 7.2.11. The issue arises in the QST vector set component, where attackers can cause a crash by executing crafted SQL statements. This vulnerability can be reproduced using the Virtuoso Docker image.

Impact

Exploitation of this vulnerability leads to a crash of the Virtuoso database server, causing a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by creating a SQL table and inserting a crafted SQL statement that exploits the QST vector set component. This can be done using the Virtuoso Docker image by starting a container, waiting for the server to initialize, and then executing the crafted SQL through the Virtuoso command-line interface.